<div dir="ltr">
<div class="">
<div class="">
<a href="http://www.nytimes.com/"><img src="http://graphics8.nytimes.com/images/misc/nytlogo153x23.gif" alt="The New York Times" align="left" border="0" hspace="0" vspace="0"></a>
</div>
<div class="">
</div>
</div>
<br clear="all"><hr align="left" size="1">
<div class="">September 4, 2013</div>
<h1>F.T.C. Says Webcam’s Flaw Put Users’ Lives on Display</h1>
<h6 class="">By
<span>
<a href="http://topics.nytimes.com/top/reference/timestopics/people/w/edward_wyatt/index.html" rel="author" title="More Articles by EDWARD WYATT"><span>EDWARD WYATT</span></a></span></h6>
<div id="articleBody">
<p>
WASHINGTON — The so-called Internet of Things — digitally connected
devices like appliances, cars and medical equipment — promises to make
life easier for consumers. But regulators are worried that some products
may be magnets for hackers. </p>
<p>
On Wednesday, the Federal Trade Commission took its first action to
protect consumers from reckless invasions of privacy, penalizing a
company that sells Web-enabled video cameras for lax security practices.
</p>
<p>
According to the F.T.C., the company, TRENDnet, told customers that its
products were “secure,” marketing its cameras for home security and baby
monitoring. In fact, the devices were compromised. The commission said a
hacker in January 2012 exploited a security flaw and posted links to
the live feeds, which “displayed babies asleep in their cribs, young
children playing and adults going about their daily lives.” </p>
<p>
“The Internet of Things holds great promise for innovative consumer
products and services,” Edith Ramirez, the commission’s chairwoman, said
in a statement. “But consumer privacy and security must remain a
priority as companies develop more devices that connect to the
Internet.” </p>
<p>
TRENDnet officials did not respond to a request for comment. </p>
<p>
While the Internet of Things is still evolving, the concept currently
embraces both industrial and consumer products. In a factory, sensors
can be used to monitor manufacturing processes, warning that a machine
needs maintenance and potentially avoiding a breakdown. At home,
so-called smart appliances like refrigerators or thermostats can feed
information via the Internet to manufacturers and service providers to
keep the products humming. </p>
<p>
In a speech last month, Ms. Ramirez noted that such developments
required more diligence by consumers and regulators. While many
individuals consent to data collection, consumers rarely are consulted
about where their personal information goes afterward. The F.T.C. plans
to conduct a workshop in November to discuss the issue, with an eye
toward drawing up rules that allow for both innovation and the
protection of consumers. </p>
<p>
Robert R. Belair, who formerly served in the commission’s division of
consumer protection and who is now the managing partner of the
Washington office of Arnall Golden Gregory, said it was not yet clear
whether the Internet of Things “changes the nature of the privacy
threat, or just exacerbates the threat in certain ways that require a
little more vigilance.” </p>
<p>
In detailing the security lapses, the commission said the company
transmitted customers’ login information over the Internet in clear,
readable text rather than encrypting the data. It also said TRENDnet’s
mobile application, which allows customers to control the home camera
from a smartphone, did not properly protect users’ credentials. When the
company became aware of the flaws, it uploaded a software patch to its
Web site and tried to alert customers. </p>
<p>
As part of the case, TRENDnet agreed to sanctions that include a 20-year
security-compliance auditing program. The company also promised not to
misrepresent the security of its cameras, the confidentiality of the
activity that its devices transmit, or consumers’ ability to control the
security of the cameras or their recordings. The agency’s four current
commissioners voted unanimously for the sanctions. </p>
<p>
The F.T.C. does not have the legal authority to impose fines in such
cases. But TRENDnet agreed to a consent order prohibiting similar
practices, so the commission has the ability to seek penalties in the
future. </p>
<p>
Despite its recent action, the F.T.C.’s authority in this area has been
called into question. The Wyndham Hotel Group is challenging the
commission’s ability to penalize companies that do not do enough to
protect consumer information, like credit card numbers. Wyndham has
argued that the agency has not published any formal rules on data
security. The case is pending in Federal District Court in New Jersey.
</p>
<p>
The case against TRENDnet highlights the potential vulnerabilities that
consumers face when they connect everyday, in-home products to the
Internet. As with e-mail accounts, online banking and shopping Web
sites, enterprising hackers can get around security systems when vendors
are sloppy. </p>
<p>
In 2010, TRENDnet began selling its digitally connected cameras under
the product name SecurView. With the device, individuals and businesses
could, via an individual Web site, monitor family members, customers or
security concerns. In three years, its camera business produced nearly
$19 million in revenue, accounting for 10 percent of the company’s total
revenue in that period. </p>
<p>
According to the F.T.C., a hacker in 2012 identified a security flaw and
circulated the information publicly. Though the company was notified of
the breach within three days, others saw the message and quickly posted
links to live video feeds of about 700 cameras. </p>
<p>
The commission said that the hacker was able “to identify a Web address
that appeared to support the public sharing of users’ live feeds.” While
only some customers opted to share their feeds publicly, the hacker
found that all of the feeds could be viewed and shared, the commission
said. After the episode, news accounts sometimes included photos taken
from the feeds. </p>
<p>
Consumers “had little, if any, reason to know that their information was at risk,” the commission said. </p>
<p>
That kind of exposure “increases the likelihood that consumers or their
property will be targeted for theft or other criminal activity,” the
F.T.C. said, and “increases the likelihood that consumers’ personal
activities and conversations or those of their family members, including
young children, will be observed and recorded by strangers over the
Internet.” </p>
<div class="">
</div>
</div>
<br>
<center>
</center>
<div id="upNextWrapper"><div style id="upNext"><div class=""><br style="clear:both"></div></div></div><br clear="all"><br>-- <br>Art Deco (Wayne A. Fox)<br><a href="mailto:art.deco.studios@gmail.com" target="_blank">art.deco.studios@gmail.com</a><br>
<br><img src="http://users.moscow.com/waf/WP%20Fox%2001.jpg"><br>
</div>